trusting multiple auth servers in the 9grid

the problem we're trying to solve is: how do we boot a file server
that trusts users from two authentication domains.  for example i want
to have my own set of university of calgary users, which do not
necessarily need to know about 9grid, but i also would like to allow
users known to the 9grid auth server(s) to come and play on my
network.

in Globus, this is done by patching OpenSSH to allow logins via X.509
certificates for its users, but surely in Plan 9 there must be an
easier way of doing it!

just today we booted a cpu server in Finland off the University of
Calgary Plan 9 network.  It worked great, if it wasn't for two
problems:

	- the network latency and bandtwidth were unbearable. to run
	lib/profile it would take a full minute

	- the auth server at ucalgary didn't know about any 'speaks
	for' relationships, adding them surely has security
	implications that we're not aware of.

this basically means that if a machine is to boot from my auth/fs
server it needs to know the bootes-equivalent password, no?  but then
it'll have full access to anything the bootes-equivalent on my network
does!

i guess it comes down to this -- if people are willing to join 9grid
with a cpu server or two, are they required to dedicate the machine
entirely to it?

isn't it possible to dedicate _just a namespace_ to 9grid and still
use the machine on the local network, with the local users?  this
sounds like a dream come true if possible -- we'd have the ability to
bring to the 9grid namespace only those resources that we care for
(for example a scratch disk) and won't have to implement restrictive
policies and divide the world into 9grid and non-9grid groups, with
strict membership in one of the two, like globus does (correct me if
wrong :).

andrey